Privacy Policy

Last updated: [EFFECTIVE DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME] (“PAIR,” “we,” “us”) collects, uses, and shares information when you use the PAIR website and mobile app (the “Service”). By using the Service you agree to this Policy. If you do not agree, please do not use the Service.

1. Information we collect

Information you give us

Account details — your name and email address, and, if you sign in with Google or Apple, the basic profile information those providers share. Passwords are handled by our authentication provider and stored only in hashed form.
Dietary preferences — diet choices and any allergies or dislikes you enter to tailor pairings and nutrition. Allergy and health-related information may be treated as sensitive data; we process it only to provide the features you ask for, on the basis of your explicit consent where required.
Saved content — the ingredients, pairings, recipes, and collections you star or create.
Communications — messages you send us (support, feedback).

Payment information

Subscriptions are processed by our payment providers — [Stripe] for web and [Apple App Store / Google Play / RevenueCat] for in-app purchases. We do not receive or store your full card number. We receive limited billing details such as your subscription status, plan, renewal date, the last four digits and card brand, and (for web) billing country, to operate and support your subscription.

Information collected automatically

Usage & device data — pages and features used, app interactions, approximate region, device type, browser, and IP address, collected through our hosting and analytics providers to run, secure, and improve the Service.
Cookies & local storage — used to keep you signed in and remember preferences (see Section 6).
On-device search — our “search by meaning” model runs locally in your browser; the text of those searches is processed on your device and is not sent to us.
Location searches — when you search a place in “What’s in season,” that place name is sent to third-party geocoding services ([Photon/komoot] and [OpenStreetMap/Nominatim]) to resolve it to a map location. We do not collect your device’s GPS location.

2. How we use information

Provide, personalize, and maintain the Service (including tailoring pairings and nutrition to your preferences).
Create and manage your account and process subscriptions and payments.
Respond to support requests and communicate service updates.
Monitor, secure, debug, and improve the Service and develop new features.
Comply with legal obligations and enforce our Terms.

3. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process personal data to perform our contractwith you (providing the Service), with your consent (e.g., sensitive dietary/allergy data and certain cookies), for our legitimate interests (securing and improving the Service), and to meet legal obligations. You may withdraw consent at any time.

4. How we share information

We do not sell your personal information. We share it only with:

Service providers acting on our behalf under contract — hosting ([Netlify]), authentication ([Supabase/Clerk]), payments ([Stripe/RevenueCat/Apple/Google]), analytics, and geocoding ([Photon/Nominatim]).
Legal and safety — to comply with law, enforce our Terms, or protect rights, safety, and security.
Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to meet legal, tax, accounting, and dispute-resolution obligations. You can ask us to delete your account at any time (see Section 8).

6. Cookies & local storage

We use cookies and browser local storage that are necessary to sign you in and remember your settings, and, where you allow it, analytics cookies to understand usage. You can control cookies through your browser; disabling essential cookies may break parts of the Service.

7. Security

We use reasonable technical and organizational measures (encryption in transit, hashed passwords, access controls) to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights & choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, to object to certain processing, and to withdraw consent. California residents may request to know, delete, and correct personal information and to opt out of “sale” or “sharing” — we do not sell or share personal information as those terms are defined. To exercise any right, contact us at [CONTACT EMAIL]; we will verify and respond as required by law. You will not be discriminated against for exercising your rights.

9. International transfers

We may process and store information in countries other than yours, including the [United States]. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

10. Children

The Service is not directed to children under [13/16], and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. We will post the new version with a revised “Last updated” date and, for material changes, provide additional notice.

12. Contact us

[LEGAL ENTITY NAME], [POSTAL ADDRESS] — [CONTACT EMAIL]. EEA/UK users may also contact our representative / data protection contact at [DPO / EU-UK REPRESENTATIVE, if applicable].